[dependabot]

Updates the pinned github/codeql-action/analyze action from 4.38.0 to 4.38.2 in .github/workflows/bytefolk-security.yml; this keeps the CodeQL analysis step on the current action release. No application source changes are included.

Canonical requirement

• Canonical Issue URL: chore(governance): enforce revisioned Issue requirements and acceptance ledgers #95
• Consumed revision: R1
• No automatic close keywords: acknowledged

Delivery ownership

• implementationOwner: @dependabot
• automatedPreReviewOwner: Dependabot compatibility and hosted CI
• humanReviewOwner: @PeterGuy326
• Separation of duties: the bot authors the dependency update; a non-author human reviewer owns the final review.

Requirement trace

REQ/AC IDs	Changed files / domain	Tests or review evidence
REQ-377 / AC-377	the pinned github/codeql-action/analyze action 4.38.0 to 4.38.2 update in .github/workflows/bytefolk-security.yml	Hosted Node 20/22/24 CI, coverage, package-consumer, container, distribution, dependency review, CodeQL, and security checks on the exact PR head

File domains

• the pinned github/codeql-action/analyze action 4.38.0 to 4.38.2 update in .github/workflows/bytefolk-security.yml; no application runtime source is changed.

Scope and non-goals

This PR updates only the the pinned github/codeql-action/analyze action pinned action version in .github/workflows/bytefolk-security.yml. It does not change product behavior, APIs, data formats, or release policy beyond the stated dependency/action update.

Validation

• Exact commands: hosted workflow command npm test; governance command npm run governance:check -- --github-event-file "$GITHUB_EVENT_PATH".
• Observed counts/results: NOT VERIFIED: hosted checks will be rerun after this PR trace is restored.
• Check URLs: https://github.com/bytefolk/digital-employee/pull/377/checks

ID	REQ/AC	Observable acceptance criterion	Command or manual steps	Environment	Expected	Observed	Status
V1	AC-377	Dependency and workflow files resolve across supported Node versions.	Hosted GitHub Actions CI matrix	Node 20, 22, and 24 GitHub-hosted runners	Required checks pass on exact head.	NOT VERIFIED: hosted checks will be rerun after this body update.	NOT VERIFIED

Security and compatibility

The change is a patch-level pin update of the GitHub-hosted codeql-action used by the security workflow; application code and workflow permissions are unchanged. Hosted dependency review and the supported Node-version matrix remain required.

Known limitations

The governance-only failed jobs must be rerun after restoring this body. No local result substitutes for required hosted checks.

Risk and rollback

Risk is limited to CodeQL workflow compatibility. Rollback is the single-file workflow pin revert; there is no data migration or irreversible side effect.

Product review handoff

• Automated pre-review result: PASS: Dependabot generated a dependency-only update.
• Human final review: PENDING
• Merge ledger owner: @PeterGuy326
• Product reviewer: @PeterGuy326
• Milestone or release packet: N/A: dependency maintenance PR; no separate product packet.
• Merge, CI, release, and model judgment do not accept or close the Issue: acknowledged